SELinux

If you have SELinux active on your system, you need to add splunk to the authenticated apps that can run in your SELinux environment.

To configure selinux to allow splunk to run, you need to run the
chcon command on the splunk lib directory. Here is what you type :

chcon -c -v -R -u system_u -r object_r -t lib_t $SPLUNK_HOME/lib 2>&1 > /dev/null

You also need to disable the check when splunk starts by adding this line
to the $SPLUNK_HOME/bin/setSplunkEnv script

export SPLUNK_IGNORE_SELINUX=1

Comments

I just checked a freshly installed splunk 3.2, and the files in $SPLUNK_HOME/lib was already tagged as system_u:object_r:lib_t. So I guess you should remove the test in the startupscript for if selinux is enabled or not. The only thing now blocking a default splunk-installation from running on selinux enabled RHEL5 is the splunk internal test for if selinux is enabled or not :-)
Posted by janfrode on Mar 12 2008, 6:10am
Does the setSplunkEnv file get overwritten on upgrade? If so, I may be better to move the SELinux check variable to the local bundle, perhaps in server.conf.
Posted by meeas on Feb 28 2008, 10:28pm